Target IP: 10.10.235.41
Challenge Description:
Reconnaissance
There are three TCP ports open on the target machine, as shown above. They are SSH, HTTP, and MySQL applications.
Performing an aggressive port scan against the three open TCP ports returns the result above. I will start enumeration with the HTTP application on port 80 to begin with.
Enumeration
Port 80: HTTP
Browsing to port 80 displays the web application above.
I created a test account on this website. Now I can access the threads. Now I need to find the white rabbit.
After looking through the different users, I find the user with the name willis interesting. The profile of this user is shown above. Maybe I can read the threads this user has participated in?
The user with the white rabbit profile picture has posted in the thread above. Apparently this website has a bug bounty program located at /bugbounty.
Browsing to /bugbounty displays the webpage above. It mentions the bug bounty report form is disabled as it is under maintenance. Maybe there is further information in the source-code of this webpage?
And yep! All submitted requests are sent to the page /reportPanel.php as shown above.
The /reportPanel.php webpage contains a list of all submitted bugs as shown above. This is incredibly useful as some bugs could still be vulnerable if they have not been patched. From the information above, it looks like the target machine is running MyBulletinBoard. Maybe the application version is also disclosed?
Out of all the bugs, I find the one above the most interesting. Apparently the web application does not use mechanisms for failed login attempts; therefore, it is possible to bruteforce the logins. This bug has been given the critical serverity level too. Maybe I can test it against the super users? The passwords are also interesting.
In total, there are eight users with super privileges. The names of these users are shown above.
On my machine, I made a file called usernames that contains the names of the moderators and the administrator as shown above. Maybe I can use the passwords that I found from the report list?
I tried to bruteforce using hydra, but I had no luck. Using Burpsuite, I intercepted a login request. Then using the Intruder mode, I set the payloads for the username and password as shown above.
The attack type I used is Cluster Bomb. The first payload list contains the usernames of the administrator and moderators. The second payload list contains the passwords which I found inside the bug bounty report as shown above.
After launching the attack, I obtained two working credentials of the moderators: PalacerKing:qwerty and ArnoldBagger:Luisfactor05 as shown above. Maybe these users contain sensitive information such as private messages that I can read?
After logging in as the moderator PalacerKing on the website, I notice this user has an unread private message about a plugin from the moderator ArnoldBagger as shown above.
The private message contains the information above. The message version 3 of the mod manager plugin for mybb sounds interesting. Maybe there is more information about this plugin under the account ArnoldBagger?
And bingo! More information about the plugin is shown above. I need to find the location of this plugin now.
I checked the different messages folders of the administrator ArnoldBagger and obtained the information above. The name /devBuilds sounds like a directory. Can I read the source-code of the plugins here?
And browsing to /devBuilds contains the plugins shown above. The modManagerv2.plugin is the biggest in file size. This is the most interesting to me. There is also an encrypted file with the name p.txt.gpg as shown above. I downloaded the two interesting files on my machine.
The source-code of the modManagerv2.plugin contains the interesting code above at line 29. The plugin reads the SQL password from the p.txt file.
This file also contains the username mod for the MySQL application, as shown above. Time to decrypt the password. The next task is to find the keymaker.
The /reportPanel.php contains the message left behind by the keymaker as shown above. Is /0100101101100101011110010110110101100001011010110110010101110010 another directory?
And browsing to /0100101101100101011110010110110101100001011010110110010101110010 displays the webpage above.
Viewing the source-code of this new webpage contains another hint left behind by the keymaker, as shown above. The variable chinese contains some English letters too, such as ofqxvg. The hint mentions Itertools.Permutations() is one possible solution among several.. Maybe I can generate the permutations of the English letters to crack the password hash of the MySQL?
Using an online tool, I obtained the permutation of all the English letters as shown above. I saved the result to a text file called perms on my machine. I also had to remove all the spaces in front of the possible passwords using the replace method.
Then using gpg2john, I obtained the password hash of the text file p.txt.gpg. Then using john and the perms password file, I successfully cracked the password! I obtained the password fvgoxq as shown above.
And using the command gpg -d p.txt.gpg and entering the password fvgoxq, I obtained the password myS3CR3TPa55 of the MySQL application as shown above.
And bingo! I successfully connected to the target machine's MySQL application using the credentials mod:myS3CR3TPa55, as shown above. Now I have access to the MySQL application.
The database modManagerv2 contains one table called members. The content of this table is shown above. What is login_key?
After some digging around, I notice the login_key is the mybbuser which can be found at cookie storage. It has a number suffix, which is the position of the user in the members table. In the previous image, the user BlackCat is in position seven. After logging in as the user PalacerKing, and changing the mybbuser to 7_JY1Avl8cqCMkIFprMxWbTxwf8dSkiv7GJHzlPDWJWWg9gnG3FB I gained access to the BlackCat user account.
And this user has interesting files shown above.
Exploitation
The file SSH-TOTP documentation.pdf contains the content above. Is this the SSH authentication method used by the target machine? The secret algorithm is shown above.
The file testing.png contains the content above. There is one SSH username called architect. And there are three shared secret tokens.
After getting stuck here, I downloaded a copy of the script from above to bruteforce the OTP pin for the SSH login.
Then I made the changes to the script by adding the three shared secret tokens, IP of the target machine, etc. Then I executed it. After running it, it managed to find a valid OTP password belonging to the user architect. Then I SSHed into the target machine. Now I have a foothold on the target machine via SSH as shown above.
Privilege Escalation
Running find / -perm -u=s -type f 2>/dev/null shows /usr/bin/pandoc has SUID bit set. Since I can run this binary, I can overwrite the /etc/passwd file to change the password of the user root.
I copied the /etc/passwd file to the home directory of user architect. Then I generated a new password using the command openssl passwd rooted and obtained the hash 2oW4gSLBIj5rA. Then using the command pandoc passwd -t plain -o /etc/passwd, I overwrote the /etc/passwd file with the new password file. Now the user root contains the password rooted.
Now I have root privileges on the target machine now. I switched to the user root using the password rooted. But the root.txt flag is not located here.
Flags
The user.txt flag is shown above.
The root.txt flag is shown above. I had to use the command find / -name "*flag*" 2>/dev/null to obtain the unusual file name /etc/-- -root.py. I read the content using cat '/etc/-- -root.py' command. The real flag is Flag{R3ALw0r1D4507Ez09WExit}.
I ran the command find / -writable -type f 2>/dev/null and found bigpaul.txt. I know bigpaul is the username of the administrator on the web application. The content of this file is shown above. Can I use the credentials bigpaul:ilovemywifeandgirlfriend022366 at the web application? The ACP Pin arithmetic results to 718008.
After logging in as the administrator bigpaul, I now have access to the administrator panel shown above.
Scrolling a little bit down after logging in at the admin panel as bigpaul, the web.txt flag is there.